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Listing of Claims : 

1 . (Currently Amended) A method for real-time measurement of the 
performance of communications on a large area network between a selected server and a 
plurality of users at client machines, based upon actual user experience, including: 

accessing a server log having user-interaction records indicative of user 
interactions that occur with one or more applications running on the selected server and that 
are carried on communications associated with routings through nodes of the network; 

determining from the records, assessments of the performance of the 
communications experienced by the plurality of users; 

determining correlations between the assessments of the performance and the 
routings of the communications; 

validating the correlations based on an analysis of one or more parameters 
associated with the user interactions , wherein the parameters include at least one parameter 
selected from the group consisting of byte-density, URL count, and unique IP address count ; 
and 

based on the correlations, modifying one or more of the routings to improve 
the performance. 

2. (Previously Presented) The method of claim 1 , wherein at least one of the 
nodes is part of a communication path connecting one of the client machines to the selected 
server. 

3. (Original) The method of claim 1, further including generating an event 
notification if a selected statistical analysis value is abnormal. 

4. (Previously Presented) The method of claim 1 , further including selecting an 
aggregation method from a set of aggregation methods for aggregating the user-interaction 
records according to a parameter. 
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5. (Previously Presented) The method of claim 4, wherein the aggregation 
method includes aggregation by log-file record column data value for each record from the 
server log. 

6-10. (Canceled) 

1 1 . (Currently Amended) A system for real-time measurement of the performance 
of communications on a large area network between a selected server and a plurality of users 
at client machines, based upon actual user experience, including: 

a server log having user-interaction records with data indicative of user 
interactions that occur with one or more applications running on the selected server and that 
are carried on communications associated with routings through nodes of the network one 
or more processors configured to 

determine from the records, assessments of the performance of the 
communications experienced by the plurality of users; 

determine correlations between the assessments and the routings; 

validate the correlations based on an analysis of one or more 
parameters associated with the user interactions , wherein the parameters associated with the 
user interactions include at least one parameter selected from the group consisting of byte- 
density, URL count, and unique IP address count ; and 

based on the correlations, generate a command for modifying one or 
more of the routings to improve the performance. 

12. (Previously Presented) The system of claim 11, wherein at least one of the 
nodes is part of a communication path connecting one of the client machines to the selected 
server. 

13. (Original) The system of claim 11, further including means for generating an 
event notification if a selected statistical analysis value is abnormal. 
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1 4. (Previously Presented) The system of claim 1 1 , further including means for 
selecting an aggregation method from a set of aggregation methods for aggregating the user- 
interaction records according to a parameter. 

15. (Previously Presented) The system of claim 14, wherein the aggregation 
method includes aggregation by log- file record column data value for each record from the 
server log. 

16-20. (Canceled) 

2 1 . (Currently Amended) A computer program, stored on a tangible computer- 
readable medium, for real-time measurement of the performance of communications on a 
large area network between a selected server and a plurality of users at client machines, 
based upon actual user experience, the computer program comprising instructions for causing 
a computer system to: 

access a server log having user-interaction records indicative of user 
interactions that occur with one or more applications running on the selected server and that 
are carried on communications associated with routings through nodes of the network; 

determine from the records, assessments of the performance of the 
communications experienced by the plurality of users; 

determine correlations between the assessments and the routings; 

validate the correlations based on an analysis of one or more parameters 
associated with the user interactions , wherein the parameters associated with the user 
interactions include at least one parameter selected from the group consisting of byte-density, 
URL count, and unique IP address count ; and 

based on the correlations, modify one or more of the routings to improve the 

performance. 

22. (Previously Presented) The computer program of claim 2 1 , wherein at least 
one of the nodes is part of a communication path connecting one of the client machines to the 
selected server. 
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23 . (Original) The computer program of claim 2 1 , further including instructions 
for causing the computer system to generate an event notification if a selected statistical 
analysis value is abnormal. 

24. (Previously Presented) The computer program of claim 2 1 , further including 
instructions for causing the computer system to select an aggregation method from a set of 
aggregation methods for aggregating the user-interaction records according to a parameter. 

25. (Previously Presented) The computer program of claim 24, wherein the 
aggregation method includes aggregation by log- file record column data for each record from 
the server log. 

26 - 30. (Canceled) 

3 1 . (Previously Presented) A method as in claim 1 , wherein determining 
assessments comprises applying a statistical analysis that determines time for specified user 
access relative to a specified interval, and sorts said user access according to a number of 
times that the application exceeds said interval. 

32. (Previously Presented) A method as in claim 1 , wherein said server log 
includes a time stamp indicating when a record was formed, a client IP address, a time taken 
to complete transmission, and a size of the transmission. 

33. (Previously Presented) A method as in claim 32, wherein said server log is 
formed by adding new data entry to the server log, and said server log is closed to further 
data entry prior to said determining assessments of the performance of the communications. 

34. (Previously Presented) A method as in claim 32, further comprising 
determining a geographic location from the IP address, and aggregating IP addresses having 
a specified relationship with a specified geographical location. 
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35. (Previously Presented) A method as in claim 32, further comprising 
aggregating said time bins into chronological order and determining trends among said time 
bins. 

36. (Previously Presented) A method as in claim 32, wherein determining 
assessments of the performance of the communications comprises determining a computer 
byte density, transfer fate, and error fraction. 

37. (Previously Presented) A method as in claim 32, wherein determining 
correlations comprise applying a statistical analysis to assess a performance related 
measurement against a geographical location of a client. 

38. (Previously Presented) A method as in claim 32, wherein determining 
correlations comprise applying a statistical analysis to assess a route traversed during use of 
the one or more applications by an end user. 

39. (Previously Presented) A method as in claim 1, wherein modifying one or 
more of the routings further comprises determining a new routing. 

40. (Previously Presented) A system as in claim 1 1 , wherein said server log 
includes a time stamp indicating when a record was formed, a client IP address, a time taken 
to complete transmission, and a size of the transmission. 

41 . (Previously Presented) A system as in claim 40, wherein said server log is 
formed by added new data as entries to the server log, and said server log is closed to further 
data entry prior to said determining assessments. 

42. (Previously Presented) A system as in claim 40, wherein said one or more 
processors converts the IP address into a geographical location, and aggregates IP addresses 
having a specified relationship with a specified geographical location. 
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43. (Previously Presented) A system as in claim 40, wherein said statistical 
analysis is an assessment of performance related measurement against a geographical 
location of a client. 

44. (Previously Presented) A system as in claim 40, wherein the one or more 
processors are configured to determine an assessment of a route traversed during use of the 
one or more applications by an end user. 

45. (Previously Presented) A system as in claim 11, further comprising a 
communication routing part, determining a new routing. 

46. (Previously Presented) The computer program as in claim 21 , wherein said 
instructions to access the server log comprises instructions to access a server log that includes 
time information about records, client IP address, time taken to compete a transmission, and 

a size of the transmission. 

47. (Previously Presented) The computer program as in claim 46, further 
comprising instructions to convert the IP address into information indicative of a 
geographical location, and to aggregate the information according to the geographical 
location. 

48. (Previously Presented) The computer program as in claim 47, further 
comprising instructions to perform a statistical analysis of performance versus geographical 
location of the client. 

49. (Previously Presented) The computer program as in claim 47, further 
comprising instructions to perform a statistical analysis assessing a route traversed during a 
network application. 

50. (Previously Presented) The computer program as in claim 2 1 further 
comprising additional instructions to determine a new routing. 
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5 1 . (Previously Presented) The method of claim 34, wherein determining a 
geographic location includes: 

defining a database comprising large area network address blocks having 

geographical or source information; 

comparing an address field in each record to the address blocks in the database; and 
associating with each record the geographical or source information from an address 

block matching the address field of the record. 

52. (Previously Presented) The method of claim 5 1 , wherein comparing an 
address field in each record to the address blocks in the database includes: 

defining an array of binary trees for the address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value; 

masking each address field in each record by a unique subnet value corresponding to 
a selected array element; 

comparing each masked address field to an address field of the address blocks within 
the binary tree of the selected array element; 

outputting selected fields of any matching address block; and 

otherwise, continuing the step of comparing with a next selected array element until a 
match is found or all array elements have been compared. 

53. (Previously Presented) The method of claim 1, further including: 
determining exit routing paths from each selected server based on the records from 

the server log; 

determining a best performing exit route based on a statistical analysis of records 
from the server log; 

biasing incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 

54. (Previously Presented) The system of claim 1 1 , further comprising: 
means for determining geographical or source information for each record; and 
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means for selecting an aggregation method to aggregate records based on such 
geographical or source information. 

55. (Previously Presented) The system of claim 54, wherein the means for 
determining geographical or source information for each record includes: 

a database comprising large area network address blocks having geographical or 
source information; 

a comparison function for comparing an address field in each record to the address 
blocks in the database; and 

an associating function for associating with each record the geographical or source 
information from an address block matching the address field of the record. 

56. (Previously Presented) The system of claim 55, wherein the comparison 
function includes: 

an array of binary trees from the address blocks in the database, each address block 
within a binary tree within an array element being masked by a corresponding unique subnet 
mask value; 

means for masking each address field in each record by a unique subnet value 
corresponding to a selected array element; 

means for comparing each masked address field to an address field of the address 
bocks within the binary tree of the selected array element; 

means for outputting selected fields of any matching address block ;and 

means for otherwise continuing the step of comparing with a next selected array 
element until match is found or all array elements have been compared. 

57. (Previously Presented) The system of claim 1 1 , further including: 

means for determining exit routing paths for each selected server based on the records 
from the server log; 

means for determining a best performing exit route based on a statistical analysis of 
records from the server log; 

means for biasing incoming and outgoing communications with respect to each server 
to use the determined best performing exit route. 
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58. (Previously Presented) The computer program of claim 2 1 , further including 
instructions for causing the computer system to: 

determine geographical or source information for each record; and 
select an aggregation method to aggregate records based on such geographical or 
source information. 

59. (Previously Presented) The computer program of claim 58, wherein the 
instructions for causing the computer systems to determine geographical or source 
information for each record further include instructions for causing the computer system to: 

define a database comprising large area network address blocks having geographical 

or source information; 

compare an address field in each record to the address blocks in the database; and 
associate with each record the geographical or source information from an address 

block matching the address field of the record. 

60. (Previously Presented) The computer program of claim 59, wherein the 
instructions for causing the computer system to compare an address field in each record to 
the address blocks in the database include instructions for causing the computer system to: 

define an array of binary trees for the address blocks in the database, each address 
block within a binary tree within an array element being masked by a corresponding unique 
subnet mask value; 

make each address field in each record by a unique subnet value corresponding to a 
selected array element; 

compare each masked address field to an address field of the address blocks within 
the binary tree of the selected array element; 

output selected fields of any matching address block; and 

otherwise, continue the step of comparing with a next selected array element until a 
match is found or all array elements have been compared. 

6 1 . (Previously Presented) The computer program of claim 2 1 , further including 
instructions for causing the computer system to: 
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determine exit routing paths from each selected server based on the records from the 
server log; 

determine a best performing exit route based on a statistical analysis of records from 
the server log; 

bias incoming and outgoing communications with respect to each server to use the 
determined best performing exit route. 

62. (Previously Presented) The method of claim 1 , wherein determining 
assessments further comprises: 

filtering out selected records from the server log, wherein the filtering removes the 
selected records from further consideration; 

aggregating records from the server log into a plurality of aggregate slots, each slot 
having at least one time bin which represents an interval of time, based on an aggregation 
method; 

performing at least one statistical analysis separately on each time bin of each 
aggregate slot; and 

outputting the results of such statistical analysis as an indication of actual access-to- 
server usage by users. 

63 . (Previously Presented) The system of claim 1 1 , wherein the one or more 
processors are further configured to: 

filter out selected records from the server log, wherein the selected records are 
removed from further consideration; 

aggregate records from the server log into a plurality of aggregate slots, each having 
at least one time bin, based on an aggregation method; 

perform at least one statistical analysis of each time bin, representing a time interval, 
of each aggregate slot; and 

output the results of each statistical analysis as an indication of actual server usage by 

users. 

64. (Previously Presented) The computer program of claim 21 , further including 
instructions for causing the computer system to: 
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filter out selected records from the server log, wherein the selected records are 
removed from further consideration; 

aggregate records from the server log into a plurality of aggregate slots, each having 
at least one time bin, based on an aggregation method; 

perform at least one statistical analysis of each time bin, representing a time interval, 
of each aggregate slot; and 

output the results of each statistical analysis as an indication of actual server usage by 

users. 

65. (Previously Presented) The method of claim 1 , wherein the parameters 
associated with the user interactions include URL count and unique IP address count. 

66. (Previously Presented) The system of claim 1 1 , wherein the parameters 
associated with the user interactions include URL count and unique IP address count. 

67. (Previously Presented) The computer program of claim 2 1 , wherein the 
parameters associated with the user interactions include URL count and unique IP address 
count. 
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